Google's 'Project Zero' Hid A Major Vulnerability in Apple's OS and iOS Cores (thestack.com) 88
In June Google's task-force against zero day exploits "identified a coding exploit in the underlying kernel of Apple's OSX and it's mobile operating system iOS, which could allow for root-level escalation of privileges for an attacker in a non-updated version of the OS," according to The Stack.
An anonymous reader writes that Google "initially refused Apple's request for sixty days' grace, but eventually settled on September 21st for disclosure. But when Apple's last-minute September fix turned out to be ineffective, Project Zero agreed to keep quiet, eventually granting Apple nearly five months of silence about the task_t bug -- which has now been fixed in the latest updates to Mac OS and iOS." The fix was released Monday, the Stack reports: Since the task_t bug allows the user to gain any entitlements they may want, it could also nullify kernel code signing, which would allow unauthorized programs to run with elevated privileges on a Mac system. Any current OSX or iOS user who has applied the latest system updates is not susceptible to the task_t vulnerability.
An anonymous reader writes that Google "initially refused Apple's request for sixty days' grace, but eventually settled on September 21st for disclosure. But when Apple's last-minute September fix turned out to be ineffective, Project Zero agreed to keep quiet, eventually granting Apple nearly five months of silence about the task_t bug -- which has now been fixed in the latest updates to Mac OS and iOS." The fix was released Monday, the Stack reports: Since the task_t bug allows the user to gain any entitlements they may want, it could also nullify kernel code signing, which would allow unauthorized programs to run with elevated privileges on a Mac system. Any current OSX or iOS user who has applied the latest system updates is not susceptible to the task_t vulnerability.
Where exactly was the bug... (Score:1)
Was this a unix-linux level bug that would affect all systems built on top or was this an OS X/iOS-induced bug from layers that sit on top of the kernel? Was BSD-derived systems similarly affected, or Android systems?
Is there a counterpart in the wild in Linux-land?
Re: (Score:3)
It was a performance hack for a microkernel system, so no. Apple had to do some extensive reworking to fix it, so it seems sensible to me to cut them some slack in this case.
Re: (Score:1, Insightful)
You mean they had to pretend to fix it while at the same time punch and abfuscate one of comparable magnitude for the no search agency to use.
FUCK OFF.
AND DIE.
Re: (Score:2)
OSX and iOS are based on NextSTEP:
http://arstechnica.com/apple/2... [arstechnica.com]
https://en.wikipedia.org/wiki/... [wikipedia.org]
Back on topic; Project Zero went the ethical way.
Re: (Score:2)
OSX and iOS are based on NextSTEP:
http://arstechnica.com/apple/2... [arstechnica.com]
https://en.wikipedia.org/wiki/... [wikipedia.org]
Back on topic; Project Zero went the ethical way.
You mean only AFTER Apple BEGGED them, don't you?
Who knows what really went on behind the scene. But still; Project Zero went the ethical way whatever the reason.
Re: (Score:2)
Until older machines (like the millions of 32 bit intel and PPC macs) get fixed, the ethical solution didn't happen. Is Google big enough to force Apple to fix those? If you think the recent IoT bot net was bad, just wait for those million of older macs get p0wned. The unsupported old macs don't get thrown away, they get handed down and they are still out there on the net waiting to cause problems. The software update option appears to still work even on my old mac mini g4 that wants to update printer dr
Re: (Score:2)
I get your point.
It all boils down to the right time to go full disclosure.
Too early; systems don't get time to be patched. Too late; information eventually leaks and prices on the black market go down to "buy" the exploit so it becomes easier and more common to see it used.
That's what I meant about ethical solution. Lately, we see more and more people publicly disclosing holes without even warning the developers. So yes, at least Project Zero seems to have made an effort regarding full disclosure time.
As f
Re: (Score:2)
I am glad you looked at the link I provided. Congratulations!
Re: (Score:2)
Are you sure you can read?
OP asked:
"Was this a unix-linux level bug?"
Can't you notice the "linux" in there?
And... linux has got nothing to do with it. Linux is not BSD it is minix.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
skankhunt42, is that you? ;-)
https://www.youtube.com/watch?... [youtube.com]
https://www.google.com/search?... [google.com]
Re: (Score:2)
Re: a lot of Google personnel uses Macs (Score:2)
Sued for what? There's no legal remedy for somebody making truthful statements. It just happens to be common industry practice to give some time for a patch to be made while making full public disclosure an ultimatum for somebody not releasing timely patches.
A lot of armchair-lawyer-Microsoft-fanboys like to fault Google for disclosing a windows bug after such a notice just because Microsoft themselves complained about it, but Google didn't break any laws, let alone any industry norms at the time, so go put
Re: (Score:2)
I can name that mitigation in a one-step operation.
1. Throw you iPhone into a wood chipper. Done!
Re: (Score:2)
You are thinking of libel. Disclosing details of a vulnerability that can be used maliciously is a gray area. It's been covered by EFF and a blackhat presentation, and it's not as cut-and-dry as you asserted.
How is it a legal gray area? Who has been successfully prosecuted for it?
Re: (Score:1)
Sued for what?
Heresy against the Church of Apple. Burning at the stake, or drawing and quartering, are the only reasonable remedies in this case.
Re: (Score:2)
That the plaintiff himself made possible by his very own neglect. That's like suing someone for sending pictures of you cheating on your wife to her and you want to get compensation for the divorce.
Re: (Score:2)
If data is released when found, the holes can be patched quickly and a world of really great security researchers can help comment on the issue and help.
Why wait a longer time for an in house fix with even the slightest the risk of an issue been in use in the wild for the same time.
Report on detection, get the community to fix. Days of wai
Title Editors Should Do Better (Score:1)
oh you fool, there are no editors (Score:2)
How is this a problem, exactly? (Score:5, Insightful)
Isn't the point of eventual disclosure to force coders/companies not to ignore bugs?
Yes, Google found a bug. But Apple didn't ignore it - their initial patch just wasn't effective. They were obviously actively working to solve the problem... so why should Google have released the exploit?
Re: (Score:2)
Did you read the summary? Apple's initial fix didn't work well, so Google responsibily allowed Apple more time to fix the vulnerability.
That is speculation. Apple was actively working on it a
Re: (Score:1)
Did you read the summary? Apple's initial fix didn't work well, so Google responsibily allowed Apple more time to fix the vulnerability.
Yes I did. And it was about allowing them 60 days which since the fix didn't even solved the problem completely become 5 months.
It likely didn't have to take 60 days or 5 months if that wasn't the time they had available to them but since it was that's how long it took. It's like there in Sweden where what the municipality get for each refugee "child" is $77 000 / year and hence that's what their solutions end up costing (or more since so many arrived), if they had only been offered $20 000 / year then they
Re: (Score:2)
Yet the vulnerability was fixed and it allowed Apple to push out an update.
Or the more likely scenario would be that the same number of engineers will still work on the vulnerability, except now an exploit was disclosed putting people
Re: (Score:1)
Whenever a change is made to the software, especially something as complicated as an OS, you need to allow time for regression testing to make sure the modification doesn't introduce a different vulnerability elsewhere.
Whenever you have a vulnerability as serious as this one, you better make sure that those regression tests go quickly.....faster than five months.
Not that I care, iOS should be liberated from its walled garden, and privilege escalation exploits are the way to do that.
Re: (Score:2)
Or the more likely scenario would be that the same number of engineers will still work on the vulnerability, except now an exploit was disclosed putting people at risk.
Has there been a case where that have actually happened? In that a known full access exploit in Microsoft or Apple products has been allowed to take five months to fix? How much negative publicity wouldn't Apple had gotten if it really took them five months to fix it with lots of exploited Apple devices all over the world? Samsung Note 7 would quickly had moved back to device issue #2?
Whenever a change is made to the software, especially something as complicated as an OS, you need to allow time for regression testing to make sure the modification doesn't introduce a different vulnerability elsewhere.
I know nothing about the vulnerability and where it existed so I can't comment on that.
Re: (Score:3)
Yes because if this had happen with Android, Google would have quickly issued a patch for all phones introduced since 2012 and all of the affected Android devices could have downloaded the patch immediately without having to wait on the OEMs and the carriers....
Now back to the real world....
Re: (Score:2)
How many non-tethered jsilbreaks have been available for the iPhone recently? The reason that the jailbreak be "non tethered" is important is because a tethered jailbreak implies physical access to the phone and the ability to unlock it.
A tethered jailbreak isn't a major security risk.
Re: (Score:2, Insightful)
Ah yes, the old "you can speed up anything by throwing more people at it," argument.
Have you ever worked in any professional engineering role? I suspect not, since you seem completely unaware of the need to understand the issue, develop a reasonable solution, implement that solution, test the solution, and then roll it out to the world. All of these take a commodity
Re: (Score:1)
Re: (Score:3)
Or would it?
This is a kernel level bug. Kernel bugs are extremely tricky and from the looks of it, it's a core kernel issue. This level of code is at the core - make a mistake here and the kernel stops working.
Hell, at this level of code, few people actually even know how it works. So you can't even throw more bodies at it, because those bodies just don't exist
Re: (Score:3)
Re: (Score:1, Interesting)
Re: (Score:2)
Google has a history of just releasing the exploit with regard to companies where Brin/Page aren't majorly invested (e.g. Microsoft), when they need extra time to finalize the fixes. One of them (I forget whcih) was on the apple board until the Android release made them competitors.
About time (Score:2)
It's been a long time waiting on a jailbreak since they got so valuable. I'd do the same thing "Hmmmm... release this as a jailbreak, or sell it for a million bucks..."
This looks easy enough to get working and is current up to 10.0.2 or whatever the latest was.
Phrasing! Click bait headline. (Score:5, Informative)
Using the words "hid a major vulnerability" is misleading. It implies Google infiltrated Apple source code to implant an exploit. Google didn't hide shit. They found the exploit, informed Apple, and kept quiet about it for the safety of the users.
Re: (Score:2)
Using the words "hid a major vulnerability" is misleading. It implies Google infiltrated Apple source code to implant an exploit. Google didn't hide shit. They found the exploit, informed Apple, and kept quiet about it for the safety of the users.
I wish you had posted this before I blew all of my mod points.
Re: (Score:3)
Fixed in 10.10.5, 10.11.6, 10.12 -- NOT just 10.12 (Score:5, Informative)
safe (Score:3, Funny)
double standards (Score:2)
that pretty much sucks to keep it hidden for 5 months.
all the while releasing a windows vulnerability before a patch is out.
sounds like double standards to me.